airalogy-engine (>=0.0.2, <=0.0.9), boxlite-mcp (>=0.1.2, <=0.3.0) +4 more potentially affected by CVE-2026-47213 via boxlite (>=0.8.2, <=0.10.0)

boxlite PYPI version =0.8.2, =0.0.2, =0.1.2, =0.1.0, =0.3.1 - iflow-mcp-boxlite-ai-boxlite-mcp 0.2.5 - soothe-daemon 1.0.5 Source cves: CVE-2026-47213 Source advisory: SNYK:PYTHON-BOXLITE-17295770...

MAL-2026-5311 Malicious code in bittensor-burn-monitor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d4b7067997b5bc9822e964b16a3b4e78b5ec637086732d143889e577fa2d886 bittensor-burn-monitor advertises itself as a Bittensor subnet burn-rate monitor but ships a covert clipboard logger that exfiltrates installers'...

python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs

A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. A remote attacker can exploit this vulnerability by sending specially crafted JWTs with unknown 'kid' key ID values. This can force the PyJWKClient.getsigningkey function to make an unlimited number of unrate-limit...

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...

EulerOS Virtualization 2.10.1 : python-pip (EulerOS-SA-2026-2034)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in...

DEBIAN-CVE-2026-45409

Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the validcontexto function pri...

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana OnPrem build 1.0.319 Vulnerability Details CVEID:CVE-2025-66418 DESCRIPTION: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the...

CVE-2026-48524

A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. A remote attacker can exploit this vulnerability by sending specially crafted JWTs with unknown 'kid' key ID values. This can force the PyJWKClient.getsigningkey function to make an unlimited number of unrate-limit...

ROOT-APP-PYPI-CVE-2026-26331 CVE-2026-26331 in rootio-yt-dlp - Patched by Root

Root has patched CVE-2026-26331 in the rootio-yt-dlp package for Root:PyPI. Multiple fixed versions available...

adversarial-workflow (>=0.4.0, <=0.9.8), ai-shell-agent (>=0.2.0, <=0.2.2) +24 more potentially affected by CVE-2026-10177 via aider-chat (>=0.69.1, <=0.86.2)

aider-chat PYPI version =0.69.1, =0.4.0, =0.2.0, =1.3.0, =0.1.0, =0.0.6, =0.1.2, =0.1.0, =0.0.4, =0.1.0, =0.0.52, =0.1.0, =0.1.0, =0.1.0, =1.0.1 and more Source cves: CVE-2026-10177 Source advisory: SNYK:PYTHON-AIDERCHAT-17895039...

adversarial-workflow (>=0.4.0, <=0.9.8), ai-shell-agent (>=0.2.0, <=0.2.2) +24 more potentially affected by CVE-2026-10175 via aider-chat (>=0.69.1, <=0.86.2)

aider-chat PYPI version =0.69.1, =0.4.0, =0.2.0, =1.3.0, =0.1.0, =0.0.6, =0.1.2, =0.1.0, =0.0.4, =0.1.0, =0.0.52, =0.1.0, =0.1.0, =0.1.0, =1.0.1 and more Source cves: CVE-2026-10175 Source advisory: SNYK:PYTHON-AIDERCHAT-17895038...

Linux Distros Unpatched Vulnerability : CVE-2026-48526

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +209 more potentially affected by CVE-2026-4944 via vllm (>=0.1.3, <=0.28.0)

vllm PYPI version =0.1.3, =0.2.1, =1.2.1, =0.0.0, =2.3.5.dev0, =0.0.1b1, =0.2.2, =0.2.4, =1.0.0, =0.2.0, =0.3.0 and more Source cves: CVE-2026-4944 Source advisory: SNYK:PYTHON-VLLM-17675624...

CVE-2026-48522

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no...

PT-2026-44397

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.8.0 through 2.12.1 Description When verifying detached JWS tokens using the unencoded-payload option "b64": false, RFC 7797, the software performs Base64URL decoding of the compact-serialization payload segment before enforcin...

pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This...

CVE-2026-44345: Improper Neutralization of Special Elements used in an OS Command

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/internal/container/frontend/dockerfile/templates/basev2.j2 interpolates docker.baseimage raw with no escaping, newline filtering, or validation. A malicious...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +209 more potentially affected by CVE-2026-9540 via vllm (>=0.1.3, <=0.28.0)

vllm PYPI version =0.1.3, =0.2.1, =1.2.1, =0.0.0, =2.3.5.dev0, =0.0.1b1, =0.2.2, =0.2.4, =1.0.0, =0.2.0, =0.3.0 and more Source cves: CVE-2026-9540 Source advisory: SNYK:PYTHON-VLLM-16887889...

The vulnerability of the Python library for working with PDF files, PyPDF, relates to the execution of a loop with an unreachable exit condition, allowing a hacker to cause a service failure.

The vulnerability of the Python library for working with PDF files, PyPDF, is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the PDF processing library PyPDF2, related to algorithmic complexity, allows attackers to trigger a service failure.

The vulnerability of the PyPDF2 library for processing PDF files is related to algorithmic complexity. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...